[rwallace]

Suppose we postulate that exploiting a security flaw is wrong, and money obtained by doing so should be forfeit.

The entire business of casinos is exploiting a security flaw in the human mind. By hypothesis, the casinos' money should be forfeit, so they have no moral grounds for trying to get it back from the people who found a way to take some of it.

Conversely, if we backtrack and cancel our postulate, then there is no basis for a claim against a gambler who exploits the software.